
Absolute OpenBSD, 2nd Edition
Unix for the Practical Paranoid
Michael W. Lucas(Author)
No Starch Press
Published on 15. April 2013
536 pages
978-1-59327-523-5 (ISBN)
System requirements
for ePUB without DRM
E-Book Single Licence
You are acquiring a single user licence for this eBook, which you might not transfer. [L]
Available for download
Description
Alles über E-Books | Antworten auf Fragen rund um E-Books, Kopierschutz und Dateiformate finden Sie in unserem Info- & Hilfebereich.
OpenBSD, the elegant, highly secure Unix-like operating system, is widely used as the basis for critical DNS servers, routers, firewalls, and more. This long-awaited second edition of Absolute OpenBSD maintains author Michael Lucas's trademark straightforward and practical approach that readers have enjoyed for years. You'll learn the intricacies of the platform, the technical details behind certain design decisions, and best practices, with bits of humor sprinkled throughout. This edition has been completely updated for OpenBSD 5.3, including new coverage of OpenBSD's boot system, security features like W^X and ProPolice, and advanced networking techniques.
You'll learn how to:
-Manage network traffic with VLANs, trunks, IPv6, and the PF packet filter
-Make software management quick and effective using the ports and packages system
-Give users only the access they need with groups, sudo, and chroots
-Configure OpenBSD's secure implementations of SNMP, DHCP, NTP, hardware sensors, and more
-Customize the installation and upgrade processes for your network and hardware, or build a custom OpenBSD release
Whether you're a new user looking for a complete introduction to OpenBSD or an experienced sysadmin looking for a refresher, Absolute OpenBSD, 2nd Edition will give you everything you need to master the intricacies of the world's most secure operating system.
You'll learn how to:
-Manage network traffic with VLANs, trunks, IPv6, and the PF packet filter
-Make software management quick and effective using the ports and packages system
-Give users only the access they need with groups, sudo, and chroots
-Configure OpenBSD's secure implementations of SNMP, DHCP, NTP, hardware sensors, and more
-Customize the installation and upgrade processes for your network and hardware, or build a custom OpenBSD release
Whether you're a new user looking for a complete introduction to OpenBSD or an experienced sysadmin looking for a refresher, Absolute OpenBSD, 2nd Edition will give you everything you need to master the intricacies of the world's most secure operating system.
More details
Language
English
Place of publication
New York
United States
Product notice
Reflowable
File size
2,59 MB
ISBN-13
978-1-59327-523-5 (9781593275235)
Schweitzer Classification
Other editions
Additional editions

Book
04/2013
2nd Edition
No Starch Press
€48.00
Article not available at the moment

Book
07/2003
1st Edition
No Starch Press
€40.00
Article exhausted; check for reprint
Person
Michael W. Lucas is a network/security engineer with extensive experience working with high-availability systems. He is the author of the critically acclaimed Absolute BSD, Absolute OpenBSD, Cisco Routers for the Desperate, and PGP & GPG, all from No Starch Press.
Content
- Intro
- Absolute OpenBSD
- Advance Praise for Absolute OpenBSD, 2nd Edition
- Dedication
- About the Author
- About the Technical Reviewer
- Foreword
- Acknowledgments
- Introduction
- What Is Security?
- What Is BSD?
- The BSD License
- AT&T vs. the World
- The Birth of OpenBSD
- The OpenBSD Community
- OpenBSD Users
- OpenBSD Contributors
- OpenBSD Committers
- OpenBSD Coordinator
- OpenBSD's Strengths
- Portability
- Power
- Documentation
- Free
- Correctness
- Security
- OpenBSD and Your Security
- OpenBSD's Uses
- Desktop
- Server
- Network Management
- About This Book
- Contents Overview
- 1. Getting Additional Help
- OpenBSD's Support Model
- The Code Is Fine. What's Wrong with You?
- Sources of Information
- Man Pages
- Manual Sections
- Viewing Man Pages
- Finding Man Pages
- Overlapping Man Page Names
- Man Page Contents
- Man Pages on the Web
- The OpenBSD Website
- Mirrors
- The OpenBSD FAQ
- Non-Project Websites
- OpenBSD Mailing Lists
- Unofficial Mailing Lists
- Read-Only Mailing Lists
- Using OpenBSD Problem-Solving Resources
- Using the OpenBSD Website
- Using Man Pages
- Using Internet Searches
- Using Mailing Lists
- Creating a Good Help Request
- How to Be Ignored
- Sending Your Email
- Responding to Email
- 2. Installation Preparations
- OpenBSD Hardware
- Supported Hardware
- Proprietary Hardware, Blobs, and Firmware
- Processors
- Memory (RAM)
- Hard Drives
- Virtualization
- Multiple Operating Systems
- Getting OpenBSD
- Official CDs
- Internet Downloads
- Mirror Site Layout
- Release Directories
- Boot Media
- Choosing Install Media
- Local Installation Servers
- File Sets
- Partitioning
- Standard OpenBSD Partitions
- Root Partition
- Swap Space
- /tmp Directory
- /var Partition
- /usr Partition
- /usr/X11R6 Partition
- /usr/local Partition
- /usr/src Partition
- /usr/obj Partition
- /home Partition
- Creating Other Partitions
- Partition Filesystems
- Multiple Hard Drives
- Understanding Partitions
- MBR Partitions
- Disklabel Partitions
- Understanding Disklabels
- Sectors and Lies
- Sectors and Disklabels
- Other Information
- 3. Installation Walk-Through
- Hardware Setup
- BIOS Configuration
- Making Boot Media
- Making Boot Floppies
- Creating Floppies on Unix-like Systems
- Creating Floppies on Microsoft Systems
- Making Boot CDs
- Installing OpenBSD
- Running the Installation Program
- Multiple Network Cards
- Setting Up Services and the First User
- Setting the Time Zone
- Setting Up the Disk
- Choosing File Sets
- Finishing the Installation
- Custom Disk Layout
- Viewing Disklabels
- Deleting Partitions
- Erasing Existing Disklabels
- Creating Disklabel Partitions
- Writing the New Disklabel
- Adding More Disks
- Advanced Disklabel Commands
- Changing Basic Drive Parameters
- Modifying Existing Partitions
- Entering Expert Mode
- Getting More Help
- 4. Post-Install Setup
- First Steps
- Checking the System Errata
- Setting the Root Password
- Software Configuration
- Time and Date
- Setting the Time Zone
- Setting the Date and Time
- Setting the Time with ntpd(8)
- Setting the Date Manually
- Hostname
- Networking
- Configuring Ethernet Interfaces
- Static IP Addresses
- Dynamic Configuration
- Setting a Default Gateway
- Setting Name Service Servers
- Mail Aliases and Status Mail
- Keyboard Mapping
- Installing Ports and Source Code
- Booting to a Graphic Console
- Onward!
- 5. The Boot Process
- Power-On and the Boot Loader
- Booting in Single-User Mode
- Mounting Disks in Single-User Mode
- Starting the Network in Single-User Mode
- Booting an Alternate Kernel
- Booting a Different Kernel File
- Booting from an Alternate Hard Disk
- Finding the Disk
- Finding the Partition
- Booting the Kernel
- Making Boot Loader Settings Permanent
- Serial Consoles
- Other Platform Serial Consoles
- Serial Console Physical Setup
- Serial Console Configuration
- Configuring the Serial Console Client
- Setting Up the Serial Console
- Testing the Serial Configuration
- Changing the Serial Console Speed
- Changing the Client Serial Port
- Serial Logins
- Multiuser Startup
- Startup System Scripts
- The /etc/rc Script
- The /etc/rc.conf Script
- The /etc/rc.conf.local Script
- The /etc/netstart Script
- The /etc/rc.securelevel Script
- The /etc/rc.local Script
- The /etc/rc.shutdown Script
- The /etc/rc.firsttime Script
- The /etc/fastboot Script
- The /etc/rc.d Directory
- Software Startup Scripts
- Third-Party rc.d Scripts
- Force-Starting Software
- 6. User Management
- The Root Account
- Adding Users
- Adding Users Interactively
- Configuring adduser
- Creating User Accounts
- Adding Users Noninteractively
- Groups in Batch Mode
- Passwords and Batch Mode
- Other Batch Mode Options
- User Account Restrictions
- Removing User Accounts
- Editing User Accounts
- Login Classes
- Login Class Definitions
- Changing login.conf
- Legal Values for login.conf Variables
- Setting Resource Limits
- Modifying the Shell Environment
- Password and Login Options
- Changing Authentication Methods
- Using Login Classes for RADIUS Authentication
- Unprivileged User Accounts
- The nobody Account
- _username
- Creating Unprivileged Users
- 7. Root, and How to Avoid It
- The Root Password
- Using Groups
- The /etc/group File
- Creating Groups
- Groups, Unprivileged Users, and Group Permissions
- Hiding Root with sudo
- Why Use sudo?
- sudo Disadvantages
- An Overview of the sudo Software
- The visudo(8) Command
- The /etc/sudoers File
- Multiple Entries in a sudoers Field
- Running Commands As Non-root Users
- Long Lines
- /etc/sudoers Aliases
- User Aliases
- Run as Aliases
- Host Aliases
- Command Aliases
- Using Aliases in /etc/sudoers
- Nesting Aliases
- Alias Naming Conventions
- Changing sudo's Default Behavior
- Overriding Defaults per Host
- Overriding Defaults per User
- Overriding Defaults per Command
- Overriding Defaults per Run As
- sudo and the Environment
- Using sudo
- sudo Password Caching
- Running Commands Under sudo
- Running Commands as Other Users
- sudoedit
- The Biggest sudo Mistake: Exclusions
- sudo Logs
- 8. Disks and Filesystems
- Device Nodes
- Raw and Block Devices
- Block Devices
- Raw Devices
- Choosing Your Mode
- Device Attachment vs. Device Name
- DUIDs and /etc/fstab
- MBR Partitions and fdisk(8)
- Viewing MBR Partitions
- Adding and Removing Partitions
- Making a Partition Bootable
- Exiting fdisk
- Labeling Disks
- Viewing Labels
- Creating Disklabel Partitions
- Backing Up and Restoring Disklabels
- The Fast File System
- FFS Versions
- Blocks, Fragments, and Inodes
- Blocks
- Inodes
- Superblocks
- Creating FFS Filesystems
- FFS Mount Options
- Mount Options and /etc/fstab
- Read-Only Mounts
- Read-Write Mounts
- Synchronous Mounts
- Asynchronous Mounts
- Soft Update Mounts
- "Don't Track Access Time" Mounts
- No Device Nodes Permitted Mount
- Execution Forbidden Mounts
- setuid Forbidden
- Do Not Automatically Mount This Filesystem
- Filesystem Integrity
- Running fsck
- Blindly Trusting fsck
- What's Currently Mounted?
- Mounting and Unmounting Partitions
- Mounting Standard Filesystems
- Mounting at Nonstandard Locations
- Unmounting Partitions
- Mounting with Options
- How Full Is That Partition?
- What's All That Stuff?
- Setting $BLOCKSIZE
- Adding New Hard Disks
- Creating an MBR Partition
- Creating a Disklabel
- Moving Partitions
- Adding New Filesystems
- Stackable Mounts
- 9. More Filesystems
- Backing Up to the /altroot Partition
- Memory Filesystems
- Creating MFS Partitions
- Mounting an MFS at Boot
- Foreign Filesystems
- Inodes vs. Vnodes
- Common Foreign Filesystems
- MS-DOS
- NTFS
- ext2fs
- CD
- Foreign Filesystem Ownership
- Removable Media
- Mounting Filesystem Images
- Attaching Vnode Devices to Disk Images
- Detaching Vnode Devices from Images
- Basic NFS Setup
- The OpenBSD NFS Server
- Exporting Filesystems
- Read-Only Mounts
- NFS and Users
- Permitted Clients
- Multiple Exports for One Partition
- NFS Clients
- Software RAID
- RAID Types
- Preparing Disks for softraid
- Creating softraid Devices
- softraid Status
- Identifying Failed softraid Volumes
- Rebuilding Failed softraid Volumes
- Deleting softraid Devices
- Reusing softraid Disks
- Booting from a softraid Device
- Encrypted Disk Partitions
- Creating Encrypted Partitions
- Using Encrypted Partitions
- Automatic Decryption
- 10. Securing Your System
- Who Is the Enemy?
- Script Kiddies
- Botnets
- Disaffected Users
- Skilled Attackers
- OpenBSD Security Announcements
- OpenBSD Memory Protection
- W^X
- .rodata Segments
- Guard Pages
- Address Space Layout Randomization
- ProPolice
- And More!
- File Flags
- File Flag Types
- Setting, Viewing, and Removing File Flags
- Securelevels
- Setting the System Securelevel
- Securelevel Definitions
- Securelevel -1
- Securelevel 0
- Securelevel 1
- Securelevel 2
- What Securelevel Do You Need?
- Securelevel Weaknesses
- Keeping Secure
- 11. Overview of TCP/IP
- Network Layers
- The Physical Layer
- The Datalink Layer
- The Network Layer
- The Transport Layer
- Applications
- The Life and Times of a Network Request
- Network Stacks
- IPv4 Addresses and Subnets
- Calculating a Decimal IPv4 Netmask
- Viewing IPv4 Addresses
- Unusable IPv4 Addresses
- Special IPv4 Addresses
- Localhost
- Private Networks
- IPv4 Addressing Pitfalls
- IPv6 Addresses and Subnets
- IPv6 Basics
- Understanding IPv6 Addresses
- Viewing IPv6 Addresses
- IPv6 Subnets
- Special IPv6 Addresses
- localhost
- Link Local Addresses
- Assigning IPv6 Addresses
- Remedial TCP/IP
- ICMP
- UDP
- TCP
- How Protocols Fit Together
- Transport Protocol Ports
- Reserved Ports
- Which Ports Are Open?
- Using netstat
- Using fstat
- IP Routing
- IPv4 Routed Network Example
- Managing Routing with route(8)
- Viewing Routes
- Route Flags
- Adding Routes
- Deleting Routes
- 12. Connecting to the Network
- DNS Resolution
- The /etc/resolv.conf File
- Default Search Domains
- Using Domain and Search
- Name Servers
- Lookup Order
- Preferred IP Protocol
- The /etc/hosts File
- Resolver vs. Dynamic Configuration
- Ethernet
- Protocol and Hardware
- IPv4 and ARP
- IPv6 and Neighbor Discovery
- Speed and Duplex
- Configuring Ethernet
- Using ifconfig(8)
- Adding an IP Address
- Removing IP Addresses
- Multiple IP Addresses on One Ethernet Card
- Configuring Default Routes
- Using Dynamic Configuration
- Configuring the Network at Boot
- Trunking
- Link Aggregation Protocols
- Trunk Configuration
- Trunks at Boot
- VLANs
- Configuring Switches
- Configuring VLAN Devices
- Configuring VLANs at Boot
- IPv6 Over Tunnels
- 13. Software Management
- Making Software
- Source Code and Software
- The Ports and Packages System
- Using Packages
- Package Files and $PKG_PATH
- Finding Packages
- Finding Packages on the Command Line
- Finding Packages on the Web
- Installing Packages
- Which Files Are Installed?
- Verbose Installation
- Ambiguous Packages
- Identifying Where Files Originate
- Uninstalling Packages
- Package Limitations
- Using Ports
- The Ports Tree
- Secondary Ports
- Read-Only Ports Tree
- Finding Software
- The Ports Index
- Finding by Keyword
- Finding via SQL
- Building Ports
- What a Port Installation Does
- Port Build Stages
- The make fetch Stage
- The make checksum Stage
- The make prepare Stage
- The make extract Stage
- The make patch Stage
- The make configure Stage
- The make build Stage
- The make fake Stage
- The make package Stage
- The make install Stage
- The make clean Stage
- Customizing Ports
- Local Distfile Mirrors
- Preferred Collection Mirrors
- Fallback Mirrors
- Primary Mirror
- Flavors
- Building a Flavored Port
- Flavors and Dependencies
- Building Multiple Flavors
- Uninstalling and Reinstalling Flavored Ports
- Subpackages
- Packages and rc.d Scripts
- 14. Everything /etc
- /etc Across Unix Variants
- The /etc Files
- /etc/adduser.conf
- /etc/amd
- /etc/authpf
- /etc/bgpd.conf
- /etc/boot.conf
- /etc/changelist
- /etc/chio.conf
- /etc/csh.*
- /etc/daily and /etc/daily.local
- /etc/dhclient.conf
- /etc/dhcpd.conf
- /etc/disklabels/
- /etc/disktab
- /etc/dumpdates
- /etc/dvmrpd.conf
- /etc/exports
- /etc/fbtab
- /etc/firmware
- /etc/fonts/
- /etc/fstab
- /etc/ftpchroot
- /etc/ftpusers
- /etc/gettytab
- /etc/group
- /etc/hostapd.conf
- /etc/hostname.*
- /etc/hosts
- /etc/hosts.equiv
- /etc/hosts.lpd
- /etc/hotplug/
- /etc/ifstated.conf
- /etc/iked/, /etc/iked.conf, /etc/ipsec.conf, and /etc/isakmpd
- /etc/inetd.conf
- /etc/kbdtype
- /etc/kerberosV/
- /etc/ksh.kshrc
- /etc/ldap/ and /etc/ldapd.conf
- /etc/localtime
- /etc/locate.rc
- /etc/login.conf
- /etc/lynx.cfg
- /etc/magic
- /etc/mail/
- /etc/mail.rc
- /etc/mailer.conf
- /etc/man.conf
- Adding to the Search Index
- Adding to Man Page Directories
- Displaying Man Pages
- Defining Man Sections
- /etc/master.passwd, /etc/passwd, /etc/spwd.db, and /etc/pwd.db
- Editing /etc/master.passwd
- Controlling Account Information Access
- /etc/master.passwd Fields
- /etc/mixerctl.conf
- /etc/mk.conf
- /etc/moduli
- /etc/monthly and /etc/monthly.local
- /etc/motd
- /etc/mrouted.conf
- /etc/mtree/
- /etc/mygate
- /etc/myname
- /etc/netstart
- /etc/networks
- /etc/newsyslog.conf
- /etc/nginx/
- /etc/nsd.conf
- /etc/ntpd.conf
- /etc/ospf6d.conf and /etc/ospfd.conf
- /etc/pf.conf and /etc/pf.os
- /etc/ppp/
- /etc/printcap
- /etc/protocols
- /etc/rbootd.conf
- /etc/rc.*
- /etc/relayd.conf
- /etc/remote
- /etc/resolv.conf and /etc/resolv.conf.tail
- /etc/ripd.conf
- /etc/rmt
- /etc/rpc
- /etc/sasyncd.conf
- /etc/sensorsd.conf
- /etc/services
- /etc/shells
- /etc/skel/
- /etc/sliphome/
- /etc/snmpd.conf
- /etc/ssh/
- /etc/ssl/
- /etc/sudoers
- /etc/sysctl.conf
- /etc/syslog.conf
- /etc/systrace/
- /etc/termcap
- /etc/ttys
- Terminal Types
- Configuring Terminals
- Making /etc/ttys Changes Take Effect
- /etc/weekly and /etc/weekly.local
- /etc/wsconsctl.conf
- /etc/X11
- /etc/ypldap.conf
- 15. System Maintenance
- Scheduled Tasks
- Daily Maintenance
- Security Checks
- Vital File Backup and Testing
- Adding Vital Files
- Filesystem Integrity Checks
- Copying Files with rdist
- Silencing /etc/daily
- Weekly Maintenance
- Monthly Maintenance
- Custom Maintenance Scripts
- System Logs
- Facilities
- Priority
- Sorting Messages via syslogd(8)
- Wildcards
- Excluding Information
- Combining Facilities
- Marking Time
- Local Facilities
- Selecting by Program Name
- Log Actions
- Logging to Files
- Logging to a Program
- Notifying Users
- Logging to a Remote Host
- Customizing syslogd
- Adding Extra Log Sockets
- Listening to the Network
- Syslog and Embedded Systems
- Log File Maintenance
- newsyslog.conf Fields
- Log File
- Owner
- Permissions
- Count
- Size
- Time
- Flags
- Monitoring Logs
- Adding a PID File
- Signal Name
- Command to Execute
- System Time
- Configuring ntpd(8)
- Time Redundancy
- Time Sources
- Serving Time
- Using ntpd(8)
- Hardware Sensors
- Device Drivers
- Sensor Configuration
- Sensor Types
- Settings in sensorsd.conf
- Sensors Triggering Action
- 16. Network Servers
- The inetd Small-Server Handler
- Configuring inetd
- Restricting Incoming Connections
- The lpd Printing Daemon
- The DHCP Server dhcpd
- How DHCP Works
- Configuring dhcpd(8)
- Static IP Address Assignments
- Enabling dhcpd
- dhcpd and Firewalls
- The TFTP Daemon tftpd
- Specifying a tftpd Directory
- tftpd and Files
- tftpd Logging
- Testing the TFTP Server
- The SNMP Agent snmpd
- SNMP MIBs
- MIB References
- MIB Definitions
- SNMP Security
- Configuring snmpd
- Debugging snmpd
- Getting snmpd Information
- The PF SNMP MIB
- Sensors
- Interface Memory
- CARP
- Other MIBs
- The SSH Server sshd
- Disabling sshd
- SSH Host Keys
- sshd Network Options
- chrooting Users
- Choosing the Directory
- Populating the chroot
- chrooting Specific Users
- 17. Desktop OpenBSD
- Configuring Your Console with wscons
- Screen Blanking
- Setting wscons Variables at Boot
- Running Virtual Terminals with tmux
- The tmux Status Bar and Window Names
- tmux Commands and Window Management
- Changing the Current Window
- Renaming Windows
- Terminating Windows
- Getting Online Help
- Disconnecting, Reconnecting, and Managing Sessions
- Using tmux Commands
- Setting tmux Options
- Configuring tmux
- Setting Up X
- Configuring X
- Starting X Manually
- Booting into X
- Emulating a Three-Button Mouse
- Using the cwm Window Manager
- Configuring cwm
- Modifier Keys
- Choosing a New Window Manager
- Binding a Key Sequence to a Command
- Creating cwm Windows
- Managing Windows
- Locking the Screen
- Connecting to Other Machines with SSH
- Creating an Application Menu
- Using Keyboard Navigation
- Decorating cwm
- Unmapping and Remapping Keys
- 18. Kernel Configuration
- What Is the Kernel?
- Kernel Messages
- Startup Messages
- Device Attachments
- Connections and Numbering
- Using dmassage to View Installed Devices
- Viewing and Adjusting Sysctls
- Sysctl MIBs
- Viewing Sysctls
- Changing Sysctl Values
- Types of Sysctl Values
- Numerical Sysctls
- Word Sysctls
- Table Sysctls
- Setting Sysctls at Boot
- Altering the Kernel with config(8)
- Making a Backup of the Default Kernel
- Device Drivers and the Kernel
- Enabling Drivers
- Editing the Kernel with config
- Using the help and list Commands
- Finding and Enabling Devices
- Changing Kernel Constants
- Completing Configuration
- Installing Your Edited Kernel
- Boot-Time Kernel Configuration
- 19. Building Custom Kernels
- Kernel Cautions
- Don't Build Custom Kernels
- Why Build Custom Kernels?
- Problems Building Custom Kernels
- Problems Running Custom Kernels
- Preparing for Kernel Customization
- Kernel Configuration
- Configuration Entries
- Options
- Device Drivers
- Pseudo-Devices
- Keywords
- Configuring GENERIC
- Machine-Independent Configuration
- Machine-Dependent Configuration
- Your Kernel Configuration
- Minor Changes
- Removing Options
- Removing Devices
- Wholesale Butchery
- Stripping Down the Kernel
- Gutting the Kernel
- Testing Your Kernel Configuration with config(8)
- Orphaned Devices
- Bogus Hardware
- Building a Kernel
- Kernel Build Errors
- Installing Your Kernel
- Identifying the Running Kernel
- 20. Upgrading
- Why Upgrade?
- OpenBSD Versions
- OpenBSD-current
- OpenBSD Snapshots
- OpenBSD Releases
- OpenBSD-stable
- Which Version Should You Use?
- The OpenBSD Upgrade Process
- Following the Upgrade Guide
- Install Programs
- Remove Programs and Files
- Prepare Package Upgrades
- System Configuration
- Customizing Upgrades
- Upgrading from Official Media
- Upgrading Over the Network
- Choosing File Sets
- Updating /etc
- Mounting Filesystems
- Using sysmerge(8) to Compare /etc Files
- Easy sysmerge Updates
- sysmerge and Edited Files
- Finishing sysmerge
- Updating Installed Packages
- Updating the Package Repository
- Using the Upgrade Command
- Package Options
- Package Messages
- Why Build Your Own OpenBSD?
- Preparations for Building Your Own OpenBSD
- Preparing the Base Operating System
- Getting Source Code
- Updating Source Code
- Source Code Repositories and Tags
- CVS Mirrors
- Updating to -stable
- Updating to -current
- Building OpenBSD-stable
- Upgrading the Kernel
- Building the Userland
- Building Xenocara
- Building a Release
- Bundling the Base System
- Bundling Xenocara
- Indexing the Release
- Using the Release
- Building OpenBSD-current
- Following -current
- Merging /etc
- Upgrading Ports
- 21. Packet Filtering
- Firewalls
- Enabling and Configuring PF
- Packet-Filtering Basics
- Packet-Filtering Concepts
- Stateful Inspection
- Packet Reassembly
- Default Accept vs. Default Deny
- "My Network Can Do No Wrong"
- What Packet Filtering Doesn't Do
- PF Components
- Packet Filter Control and Configuration
- Interface Groups
- PF Configuration
- Filtering Rules
- Default Permit or Default Deny
- Packet Pattern Matching
- Direction
- Interface Matching
- Address Families
- Network Protocol
- Source and Destination Address
- Source and Destination Variants
- Interface Main Address
- Source and Destination Port
- A Complete Ruleset
- Activating Rules
- Viewing Active Rules
- Filtering Rules and the State Table
- TCP States
- UDP States
- ICMP States
- Packet Filtering with Lists and Macros
- Using Lists
- Using Macros
- A Common Error: List Exclusions and Negations
- Sanitizing Traffic
- Illegal Packets
- Packet Reassembly
- Packet Modification
- Blocking Spoofed Packets
- PF Options
- The set block-policy Option
- The set limit Option
- frags Limit
- The src-nodes Limit
- The states Limit
- The tables and table-entries Limits
- Setting Limits
- The set optimization Option
- The set skip Option
- 22. Advanced PF
- Packet Filtering with Tables
- Defining Tables
- Using Tables
- Viewing Tables
- Searching Tables
- Changing Tables
- Tables and Automation
- Using NAT
- Private NAT Addresses
- Configuring NAT
- How NAT Works
- Multiple or Specific Public Addresses
- Bidirectional NAT
- Bidirectional NAT and Security
- Packet Filtering, Bidirectional NAT, and Rule Order
- Redirection
- Multiple Addresses and Interface Groups
- Port Manipulation and Ranges
- Transparent Interception
- Anchors
- Adding Rules to Anchors
- Anchor Rules from Files
- Anchor Rules in pf.conf
- Anchor Rules via pfctl
- Viewing and Flushing Anchors
- Conditional Filtering
- Nested Anchors: /*
- FTP and PF
- Configuring ftp-proxy(8)
- PF Configuration and the FTP Proxy
- Bandwidth Management
- Queues for Bandwidth Management
- Parent Queue Definitions
- Child Queue Definitions
- Queue Options
- Default
- Random Early Detection
- Explicit Congestion Notification
- borrow
- A CBQ Ruleset
- Assigning Traffic to Queues
- Using the match Keyword
- Viewing Queues
- PF Edges
- Using Include Files
- Skipping Matches with quick
- Logging PF
- Reading PF Logs
- Real-Time Log Access
- Filtering tcpdump
- Ruleset Tracing
- 23. Customizing OpenBSD
- Virtualizing OpenBSD
- Diskless Installation
- Diskless Hardware
- DHCP Server Setup
- Per-Host or Per-Network Configuration
- Per-Network Configuration
- Per-Machine Configuration
- TFTP Server Setup
- Completing Diskless Installation
- Running Diskless
- Using rarpd(8) for Reverse ARP
- Running bootparamd(8)
- Setting Up the NFS Root Directory
- Exporting the Root Directory
- Populating the Diskless Userland
- Power On!
- USB Installation Media
- Using a Virtual Machine
- Running a Diskless Installation
- Converting ISO Images
- Customizing OpenBSD Installations
- Custom File Sets
- Post-Install Shell Scripts
- Customizing Upgrades
- A. Afterword
- Index
- About the Author
- Copyright
System requirements
File format: ePUB
Copy protection: without DRM (Digital Rights Management)
System requirements:
- Computer (Windows; MacOS X; Linux): Use a reader that can handle the file format ePUB, such as Adobe Digital Editions or FBReader – both free (see eBook Help).
- Tablet/Smartphone (Android; iOS): Install the free app Adobe Digital Editions or the app PocketBook (see eBook Help).
- E-reader: Bookeen, Kobo, Pocketbook, Sony, Tolino and many more (not Kindle).
The file format ePUB works well for novels and non-fiction books – i.e., 'flowing' text without complex layout. On an e-reader or smartphone, line and page breaks automatically adjust to fit the small displays.
This eBook does not use copy protection or Digital Rights Management
For more information, see our eBook Help page.